CVE-2025-5433: Fengoffice Feng Office index.php sql injection

Published Jun 2, 2025

Updated

A vulnerability was found in Fengoffice Feng Office 3.5.1.5 and classified as critical. Affected by this issue is some unknown functionality of the file /index.php?c=account&a=settimezone. The manipulation of the argument tzoffset leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected Software

1 affected component

Fengoffice Feng Office

Event History

Jun 2, 2025

CVE Published

via MITRE·06:31 AM

Data Sourced

via MITRE·06:31 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:15 AM

DescriptionSeverityWeakness

Dec 31, 57405

Event

via FIRST·02:01 PM

Frequently Asked Questions

What is the severity of CVE-2025-5433?

CVE-2025-5433 is classified as a critical vulnerability.

How do I fix CVE-2025-5433?

To fix CVE-2025-5433, ensure to sanitize and validate user inputs, particularly in the tz_offset argument.

What type of vulnerability is CVE-2025-5433?

CVE-2025-5433 is an SQL injection vulnerability affecting Feng Office.

Which software is affected by CVE-2025-5433?

CVE-2025-5433 affects Fengoffice Feng Office version 3.5.1.5.

What is the potential impact of exploiting CVE-2025-5433?

Exploitation of CVE-2025-5433 could allow an attacker to execute arbitrary SQL commands in the database.